基于多元增量分析的全网络在线异常检测方法  

Online Network-Wide Anomaly Detection Algorithm Based on Multivariate Incremental Component Analysis

作　　者：李宇翀[1,2,3] 魏东[4] 罗兴国[1] 钱叶魁 刘凤荣 

机构地区：[1]国家数字交换系统工程技术研究中心 [2]通信网信息传输与分发技术重点实验室 [3]71834部队 [4]华北水利水电大学 [5]解放军防空兵学院导弹系

出　　处：《上海交通大学学报》2016年第9期1368-1375,共8页Journal of Shanghai Jiaotong University

基　　金：国家重点基础研究发展规划(973)项目(2012CB315901;2013CB329104);国家自然科学基金资助项目(61309019;61372121);上海市科学技术委员会资助项目(13DZ1108800);通信网信息传输与分发技术重点实验室基金项目

摘　　要：现有的全网络流量异常检测方法大多是离线方法或是对其进行数据更新的简单在线化改造,无法提供良好的在线检测性能.以全网络多维流量数据为研究的数据源,采用多元增量分析的方法,提出一种非先验自适应的在线异常检测算法.该算法以增量的方式构建流量矩阵的常态模型,不需要特殊的训练数据和独立的训练阶段.采用仿真实验数据和骨干网Abilene的采集数据,并通过与现有广泛采用的离线和在线方法进行对比分析,结果表明该算法在保持较好的检测性能的基础上实现了全网络在线异常检测.Most of the network-wide anomaly detection approaches are offline, which cannot satisfy the de- mand of online detection. In order to solve the problem, an improved multivariate online anomaly detection algorithm was proposed which assumed no prior model for normal or anomalous network traffic based on incremental multivariate analysis, and a network-wide traffic matrix was employed as data source in the research. The algorithm constructed the normal model of traffic matrix incrementally which could adapt to variations in the structure of normal traffic itself. The analyses of datasets from Abilene and simulation experiments and comparison with existing offline and online methods show that the algorithm not only achieves online network-wide anomaly detection but also has a very good detection performance.

关 键 词：多元增量分析 多维数据处理 全网络异常检测 在线算法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]